Re: [patch 1/2] c/r: prctl: Add ability to set newmm_struct::exe_file

[Cyrill Gorcunov]

On Mon, Mar 19, 2012 at 11:41:36PM +0100, richard -rw- weinberger wrote:
> >
> > Actually I liked multi-shot version more but Matt arguments convinced
> > me that one-short fashion is more "secure" in terms of overall kernel
> > state and potential transitions/changes of this /proc/pid/exe symlink.
> >
> > At least with one-shot version the admin may be sure that the symlink
> > is never changed more than once, ever.
> >
> 
> And changing it once does not harm security?
> I'm sure that rootkit writers will like this feature...

The one-shot limits the amount of transitions, but you still
have to obtain CAP_SYS_RESOURCE before you'll be able to change
this symlink (ie it's not 'anyone-can-change-it' feature).

	Cyrill
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/